SR 26-2 explained: what replaced SR 11-7 and how scope works
Which systems the Federal Reserve's model risk guidance covers, which it leaves to your bank's own governance, and how to sort the parts of a workflow where a model, an agent and a person each play a role.
On this page
SR 26-2 is the Federal Reserve's model risk management guidance, issued on 17 April 2026 and replacing SR 11-7 and SR 21-8. For AI agents, scope is the question that matters. Footnote 3 places generative and agentic AI outside the guidance, while its principles still apply to traditional statistical and quantitative models and to AI models that are neither generative nor agentic. Whether a particular component counts as an in-scope model is your bank's determination, and components outside scope still need controls under your bank's own risk management and governance.
Key takeaways
- Classify components, not whole workflows. One workflow can hold an in-scope model next to an out-of-scope agent.
- The agentic exclusion identifies a boundary of this guidance. It is not an exemption from risk management.
- A statistical model does not leave scope because an agent calls it.
- Not every calculation near an agent is automatically an in-scope model either. That classification stays with your bank.
- We suggest recording each classification with its basis and owner, because that is what a reviewer will ask to see.
What SR 26-2 is and which banks it applies to
SR 26-2 is a Federal Reserve supervision and regulation letter. The guidance itself is in an attachment to the letter. Because it supersedes SR 11-7, policies, vendor questionnaires and project templates that still cite SR 11-7 point to replaced guidance. Some of those references need only a citation update. Others describe internal practices your bank may choose to keep, and those now need a reason of their own.
The table below collects the statements this page relies on, with where to find them.
What the letter and its attachment say. Page numbers refer to the attachment PDF.
Swipe or scroll horizontally to see all columns.
| Topic | What the source says | Where |
|---|---|---|
| Date and earlier guidance | Dated 17 April 2026. Supersedes SR 11-7 and SR 21-8. | SR 26-2 letter |
| Which banks | Generally most relevant to banking organizations with more than $30 billion in total assets. May also be relevant to a smaller bank with significant model risk exposure. | Attachment, pages 2 to 3 |
| Legal status | Does not set enforceable standards. Violations of law or unsafe or unsound practices may still lead to supervisory action. | Attachment, page 2, footnote 1 |
| Scope | Generative and agentic AI are outside scope. The principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models. A bank's risk management and governance should guide controls for what the guidance does not cover. | Attachment, page 3, footnote 3 |
Does SR 26-2 cover AI agents?
Not as agentic AI. An agent that plans steps, calls tools and takes actions sits outside the guidance's scope, so it is not assessed under SR 26-2 as a model.
That answers which framework does not apply. It leaves open which controls the agent needs, and footnote 3 hands that question to your bank's own risk management and governance. The guidance does not call agents low risk, and it does not list controls for them.
Two readings of the footnote go wrong in opposite directions. The first assumes everything near an agent leaves scope with it. A statistical credit model keeps its standing when an agent calls it, so wrapping a model in an agent is no reason to stop reviewing the model. The second assumes every conventional tool in the workflow is automatically in scope. The principles apply to models, and whether a particular calculation, rule set or vendor tool meets the guidance's idea of a model is a call your bank makes and records.
Classifying the components of a mixed workflow
Most real workflows combine kinds of system, so classification happens one component at a time. The lending workflow below is illustrative and does not describe a particular bank or product.
- AgentGathers borrower documentsRetrieves files and checks they belong to the right case.
- Conventional modelProduces a credit scoreA statistical model your bank already validates.
- AgentDrafts the credit packageSummarizes documents and restates the model's output.
- Credit officerMakes the lending decisionThe decision of record, under your credit policy.
Your bank's governance covers the whole workflow: how the parts connect, what the agent may access, and where the person takes over.
Figure 1 as text
- An agent gathers borrower documents and checks they belong to the right case. As agentic AI, it is outside SR 26-2 and falls under the bank's own governance.
- A conventional statistical credit model produces a score. If the bank classifies it as a model under the guidance, it is assessed under SR 26-2 and the bank's model risk practices.
- An agent drafts the credit package, summarizing documents and restating the model's output. It is outside SR 26-2 and falls under the bank's own governance.
- A credit officer makes the lending decision of record under the bank's credit policy.
The bank's governance covers the whole workflow, including how the parts connect, what the agent may access and where the person takes over. Classifying each component is the bank's decision.
Classifying one component settles nothing about the others. A validated credit model can still receive the wrong borrower's file from the agent upstream, and a correct score can be overstated in the package the agent drafts. Those risks live in the connections between components, which is why the workflow as a whole needs governance even after every part has a label. For the full lending walkthrough with review questions, read SR 26-2 and agentic AI: what banking teams need to know.
Start with one component, not the whole workflow
The bank's own risk management and governance guide its controls.
A conventional tool or calculation is not automatically an in-scope model. Document the basis for the bank's scope call.
Record classification, basis and owner. Govern how components pass data and decisions between them.
What the source says, and what we suggest
The distinction below separates statements in the guidance from suggested operating practices.
- SR 11-7 and SR 21-8 are superseded.
- Generative and agentic AI are outside scope.
- The principles apply to statistical, quantitative and non-generative, non-agentic AI models.
- Bank governance should guide controls for what is not covered.
- List the components of each workflow separately.
- Record each scope classification, its basis and its owner.
- Describe in plain words what the agent may read, propose and change.
- Keep model outputs traceable inside what the agent produces.
- Agree in advance which changes trigger another review.
Figure 3 as text
The guidance and letter say: SR 11-7 and SR 21-8 are superseded; generative and agentic AI are outside the guidance's scope; its principles apply to traditional statistical and quantitative models and to non-generative, non-agentic AI models; and a bank's risk management and governance should guide controls for what it does not cover.
Moring suggests, as practice rather than requirements: list each workflow's components separately; record each scope classification with its basis and owner; describe in plain words what the agent may read, propose and change; keep model outputs traceable inside what the agent produces; and agree in advance which changes trigger another review.
Practical steps for an agent project
Everything in this section is Moring's suggested practice. None of it is a requirement of SR 26-2. Your model risk, compliance and legal teams decide what applies to your bank.
- Describe the work before you label it. Say what triggers the workflow, what information it uses, what it produces and who receives the result.
- Split it into components. Separate the parts that estimate or predict from those that retrieve, generate text or take actions.
- Record the scope call. For each component, note how your bank classified it, which part of the guidance the call rests on, why, and who made the decision.
- State the agent's authority. For example: "assembles the credit package, uses the score as one input, cannot approve a loan." The AI agent governance explainer covers authority, approvals and stopping an agent.
- Make the record connect the pieces. A reviewer should be able to trace the documents used, the model output, what the agent wrote and the officer's decision. The AI control plane explainer shows where that record can be produced.
- Name the changes that reopen review. Typical ones are a new data source, a new tool, a different model, or permission to update a record.
One more suggestion: avoid describing an agent as "SR 26-2 compliant". The guidance places agentic AI outside its scope, so the label hides the very distinction your reviewers need to see.
What this page does not cover
- Legal or regulatory advice for your bank.
- A summary of every change SR 26-2 makes. This page covers scope and classification. Read the attachment for the rest.
- How other banking agencies treat model risk at the institutions they supervise.
- Other obligations that may apply to an agent workflow. Depending on the workflow, teams often look at operational risk, third-party risk and, where customers are affected, consumer protection. Your compliance and legal teams decide which apply.
Frequently Asked Questions
Does SR 26-2 cover agentic AI?
No. The scope language in SR 26-2 distinguishes traditional statistical and quantitative models, including non-generative and non-agentic AI, from generative and agentic AI. A footnote states that generative and agentic AI are outside the guidance and directs banks to their own risk management and governance practices for tools and systems it does not cover.
What replaced SR 11-7?
SR 26-2 replaced SR 11-7 on 17 April 2026. The revised guidance also supersedes SR 21-8. Review references to SR 11-7 as current guidance. Your bank may retain useful internal practices, with their basis made explicit.
If agents are outside SR 26-2, what applies to them?
Your own risk management and governance practices, and whatever else already applies to the activity : consumer protection, third-party risk, records retention, and your internal model risk and audit standards. The Federal Reserve has said other risk management and governance practices are expected to support the adoption of generative and agentic AI. Being outside this guidance does not remove the need for appropriate governance. Your compliance and legal teams determine the other obligations that apply.
Our AI review is stuck on this. What do reviewers actually ask for?
As a practical starting point, Moring suggests four things: a component-level description that separates models, retrieval, generated content and actions; the boundary the agent operates inside; the evidence of each run, including policy decisions and human approvals; and a named owner for the outcome. These are suggested review materials, not a checklist prescribed by SR 26-2.
Can one workflow contain both covered models and out-of-scope agents?
Yes. An agent may retrieve documents, call a conventional risk model, and draft a recommendation from the model output. A model the bank classifies as in scope is assessed under SR 26-2; agentic AI around it is outside the guidance. Not every conventional calculation or tool meets its model definition. Reviewing the two as one undifferentiated “AI system” is what makes the review hard, so the practical step is to describe the workflow component by component.
What should we do first?
Pick one workflow that is already under review and write down its components: which parts are models, which are retrieval, which are generated content, and which are actions the agent can take. That description helps reviewers distinguish components assessed under SR 26-2 from those governed under the bank’s other practices.
Related reading
Sources
- Michelle W. Bowman: Artificial Intelligence in the Financial System: remarks delivered 27 April 2026 and published 1 May 2026. Explains the expectation that other risk-management and governance practices support generative and agentic AI.
- Federal Reserve: SR 26-2, Revised Guidance on Model Risk Management (letter): date of 17 April 2026 and the superseded letters SR 11-7 and SR 21-8. Links to the attachment below.
- SR 26-2 attachment: the guidance (PDF): applicability on pages 2 to 3; legal status in footnote 1 on page 2; the scope statement on generative and agentic AI, and the models its principles apply to, in footnote 3 on page 3. Page numbers refer to this PDF.